TAICHUNG – November 04, 2026 -- Winbond Electronics Corporation has released a CRA Conformance and Integration Kit for its TrustME W77Q Secure Flash family, bundling hardware, software, testing resources, reference designs and security evidence to help manufacturers prepare for the European Union's Cyber Resilience Act (CRA).
W77Q Secure Flash carries SESIP Level 2 certification, but not product-level CRA conformity
The CRA sets cybersecurity requirements across the lifecycle of products with digital elements, including secure design and development, production, vulnerability handling, software maintenance and technical documentation. W77Q has achieved SESIP Level 2 certification, giving customers independently assessed evidence for their own compliance work. Winbond states that component-level certification does not by itself establish CRA conformity of a finished product.
Seven resource blocks cover mapping, integration, testing and documentation
The kit includes:
- A mapping of CRA Annex I security objectives to W77Q security capabilities
- Hardware integration guidelines for using W77Q as an external NOR Flash while minimizing board-level changes
- A low-level security library and sample code for secure storage, authentication, software updates, recovery and lifecycle management
- An integration test suite with positive and negative scenarios
- Conformance collateral, including risk-assessment templates and vulnerability-handling and supply-chain documentation
- A conformity checklist and reference designs pairing W77Q with selected MCU platforms
- Open-source resources, including Linux reference drivers and remote secure software-update components
Platforms using external NOR Flash can migrate without adding a separate security chip
Where package, voltage, interface and system requirements align, W77Q can replace external NOR Flash. Winbond says this strengthens external memory security without a separate security component or a full platform redesign, though hardware and software changes may still be required.
Supported W77Q devices authenticate updates with NIST SP 800-208 LMS signatures
Supported devices use the Leighton-Micali Signature (LMS) scheme specified in NIST SP 800-208 to authenticate firmware and software updates, building on Winbond's post-quantum cryptography work. Protected storage, authenticated updates, version enforcement, rollback protection and recovery support security across the product lifecycle. The PQC-protected update path applies where the selected device and system architecture support it.
José Pulido, Director at jtsec Beyond IT Security, said the documentation "significantly reduces the engineering effort" required for internal self-assessments and third-party conformity audits.
Winbond targets the kit at connected products in industrial automation, Industrial IoT, networking, smart building and access control, HVAC, energy, EV charging and smart appliances.